Differential privacy bounds the leakage when two datasets \({D}\)  and \({D}^{\prime }\)  differ in any instance. Thus, by following prior work [1]}, we create an adversary that crafts a poisoned malicious input \(x\)  such that when the model trains on this input, its output will be different from the case where the instance is not included—thus making membership inference easier.
